Theoretical Computer Science. Nondeterministic functions and the existence of optimal proof systems

Transcription

1 Theoretical Computer Science 410 (2009) Contents lists available at ScienceDirect Theoretical Computer Science journal homepage: Nondeterministic functions and the existence of optimal proof systems Olaf Beyersdorff a,, Johannes Köbler b, Jochen Messner c a Institut für Theoretische Informatik, Leibniz-Universität Hannover, Germany b Institut für Informatik, Humboldt-Universität zu Berlin, Germany c Fakultät für Elektronik und Informatik, Hochschule Aalen, Germany a r t i c l e i n f o a b s t r a c t Article history: Received 5 December 2007 Received in revised form 13 May 2009 Accepted 24 May 2009 Communicated by O. Watanabe Keywords: Optimal proof systems Nondeterministic functions Disjoint NP-pairs We provide new characterizations of two previously studied questions on nondeterministic function classes: Q1: Do nondeterministic functions admit efficient deterministic refinements? Q2: Do nondeterministic function classes contain complete functions? We show that Q1 for the class NPMV t is equivalent to the question whether the standard proof system for SAT is p-optimal, and to the assumption that every optimal proof system is p-optimal. Assuming only the existence of a p-optimal proof system for SAT, we show that every set with an optimal proof system has a p-optimal proof system. Under the latter assumption, we also obtain a positive answer to Q2 for the class NPMV t. An alternative view on nondeterministic functions is provided by disjoint sets and tuples. We pursue this approach for disjoint NP-pairs and its generalizations to tuples of sets from NP and conp with disjointness conditions of varying strength. In this way, we obtain new characterizations of Q2 for the class NPSV. Question Q1 for NPSV is equivalent to the question of whether every disjoint NP-pair is easy to separate. In addition, we characterize this problem by the question of whether every propositional proof system has the effective interpolation property. Again, these interpolation properties are intimately connected to disjoint NP-pairs, and we show how different interpolation properties can be modeled by NP-pairs associated with the underlying proof system Elsevier B.V. All rights reserved. 1. Introduction Most computational tasks are naturally formulated as functional problems, i.e., for a given input a solution to the problem instance has to be computed. In contrast, computational complexity theory mainly studies language problems and their associated complexity classes. Of course, by studying the undergraph { x, y y f (x)} of a function f, every functional problem can be transformed into a corresponding decision version, which justifies the focus on language complexity. On the other hand, some computational phenomena are most naturally addressed in the functional setting, and this particularly applies to nondeterministic functions (cf. [54] for a beautiful argument on this theme). Part of the results of this paper appeared in an extended abstract in the proceedings of the conference FSTTCS 2000 [J. Köbler, J. Messner, Is the standard proof system for SAT P-optimal? in: Proc. 20th Conference on Foundations of Software Technology and Theoretical Computer Science, in: Lecture Notes in Computer Science, vol. 1974, Springer-Verlag, Berlin Heidelberg, 2000, pp ]. This work was done while the first author was at Humboldt University Berlin and the third author was at Ulm University. Research was partially supported by DFG grant KO 1053/5-1. Corresponding author. Tel.: addresses: beyersdorff@thi.uni-hannover.de (O. Beyersdorff), koebler@informatik.hu-berlin.de (J. Köbler), jochen.messner@htw-aalen.de (J. Messner) /$ see front matter 2009 Elsevier B.V. All rights reserved. doi: /j.tcs

2 3840 O. Beyersdorff et al. / Theoretical Computer Science 410 (2009) Prominent questions in the functional context are in particular: Q1: Do nondeterministic functions possess efficient deterministic refinements? Q2: Do nondeterministic function classes possess complete functions? During the last decade, these problems have been intensively studied for a variety of function classes (cf. [53] for a comprehensive taxonomy or [24,29] for equivalent characterizations). Question Q1 is important in connection with cryptographic applications, as Q1 (for the function class NPMV t ) is equivalent to the question of whether all polynomialtime computable onto honest functions are invertible in polynomial time. The question was further characterized by Fenner, Fortnow, Naik, and Rogers [15] by a number of previously studied complexity-theoretic assumptions, and they named the list of these equivalences as Q (cf. also [17]). Determining the precise strength of Q seems to be intricate. On the one hand, Q has unlikely collapse consequences such as P = NP conp. On the other hand, Q does not seem as strong as to imply a collapse of the polynomial hierarchy [11]. In this paper, we will argue that the above two questions on function classes are closely connected to disjoint NP-pairs and their generalizations, as well as to problems about proof systems. Disjoint NP-pairs have recently been intensively studied [42,18 22,49,5,4,3], mainly, because they are suitable objects to model the security of cryptosystems [23,33], and further, because they are intimately connected to propositional proof systems [45,42,20,22,4]. Nondeterministic functions were already linked to disjoint conp-pairs by Fenner et al. [15]. Here we will extend this connection to further function classes and disjoint NP-pairs as well as tuples of disjoint NP-sets (cf. [5]) and disjoint conp-pairs. This correspondence provides an alternative view on disjoint NP-pairs and allows elegant characterizations of Questions Q1 and Q2 above. Namely, Q1 is equivalent to the statement that every disjoint NP-pair is easy to separate, while Q2 is equivalent to the problem, whether the class of disjoint NP-pairs (and its generalizations) possess complete elements. In the context of NP-pairs, this question was posed by Razborov [45], and it has been intensively studied during the last years [18,19,5,4,3]. Our characterizations restate and unify some of these recent results in terms of nondeterministic functions. There is also an important connection of nondeterministic functions (and equivalently of disjoint sets) to the field of proof systems, as introduced for arbitrary languages by Cook and Reckhow [12]. We will show that in this setting, Question Q1 (for functions from NPSV) can be restated as the question of whether all propositional proof systems satisfy the effective interpolation property (cf. [31,33]). This again is equivalent to the statement that every disjoint NP-pair is P/poly-separable, which in turn implies that NP conp P/poly and UP P/poly. Similarly, we also provide another characterization of Q (or equivalently, Question Q1 for functions from NPMV t ). Namely, we investigate the problem of whether the standard proof system sat for SAT is p-optimal, 1 where proofs in sat are given by a satisfying assignment for the formula in question. We show that this question is equivalent to the assertion Q, and it is further characterized by the statement that the two common notions of reductions between proof systems (i.e., simulations [32] and p-simulations [12]) coincide. Thus Q is also equivalent to the statement that every optimal proof system is p- optimal. Under the weaker assumption of the mere existence of a p-optimal proof system for SAT, we can still show that every language with an optimal proof system also has a (possibly different) p-optimal proof system. The (likely) assumption that there are no p-optimal proof systems for SAT (as well as for TAUT) also has some practical implications due to its connection to the existence of optimal algorithms (cf. [32,48,49,36]). Note that usually a decision algorithm for SAT also provides a satisfying assignment for any positive instance. However, if sat is not p-optimal, then no decision algorithm for SAT that produces satisfying assignments for positive instances can be optimal (cf. Theorem 17). In fact, a stronger consequence can be derived: if sat is not p-optimal, then there is a non-sparse set of easy instances from SAT for which it is hard to produce a satisfying assignment (cf. Theorem 21). It has been observed in [46,28] that (p-)optimal proof systems for certain languages can be used to define complete sets for certain promise classes. For example, if TAUT has an optimal proof system, then NP Sparse has a many-one complete set, and if TAUT as well as SAT have a p-optimal proof system, then NP conp has a complete set. We complete this picture here by showing that already a p-optimal proof system for SAT can be used to derive completeness consequences. In particular, we prove that a p-optimal proof system for SAT implies complete functions for NPMV t (which in turn implies complete disjoint conp-pairs). Further, the existence of an optimal proof system for TAUT implies the existence of complete functions for NPkV (or equivalently, complete tuples of NP-sets with some disjointness conditions). And finally, the existence of optimal proof systems for TAUT and p-optimal proof systems for SAT implies the existence of complete functions for NPSV t (or equivalently, complete sets for NP conp). Overview of the paper This paper is organized as follows. After fixing notation and reviewing relevant definitions about function classes, proof systems, and disjoint tuples (Section 2), we start in Section 3 by exploring the connections between nondeterministic functions and pairs (as well as tuples) of disjoint sets. Particular attention is directed towards the problem of the existence of complete functions and pairs for the respective classes (Question Q2 above). 1 Pavel Pudlák posed this question during the discussion after Zenon Sadowski s talk at CSL 98 [47].

3 O. Beyersdorff et al. / Theoretical Computer Science 410 (2009) Section 4 is devoted to Question Q1 above, i.e., whether functions from NPSV possess total refinements in FP or FP/poly. It turns out that this questions is intimately connected to different interpolation properties of propositional proof systems, and we characterize these interpolation properties by disjoint NP-pairs, associated with the proof system. In Section 5 we investigate whether the standard proof system sat for SAT is p-optimal. We show this question to be equivalent to the assertion Q from [15] (and hence to Question Q1 for NPMV t ). In addition we provide several new characterizations of this problem in terms of simulations and optimal algorithms. Finally, in Section 6 we analyze the weaker question of whether there exists a p-optimal proof system for SAT. We show that this is equivalent to the statement that every language with an optimal proof system also has a p-optimal proof system, and derive some collapse consequences from these assumptions. 2. Preliminaries and notation Let Σ = {0, 1}. We denote the cardinality of a set A by A and the length of a string x Σ by x. The empty word is denoted by λ. FP is the class of (partial) functions that can be computed in polynomial time. A set S is called sparse if the cardinality of S Σ n is bounded above by a polynomial in n. S is called printable if there exists a function in FP which on input 1 n outputs all elements in S of length n. We use,..., to denote a standard polynomial-time computable tupling function. For the definitions of standard complexity classes like P, NP etc. we refer to the monographs [2] and [39]. A function h is called FP-invertible if there is a function f FP that inverts h, i.e., h(f (y)) = y for each y in the range of h. A function h is honest if for some polynomial p, p( h(x) ) x holds for all x in the domain of h. We call a function g an extension of a function f if f (x) = g(x) for any x in the domain of f. A function r : N N is called super-polynomial if for each polynomial p, r(n) > p(n) for almost every n 0. A set B P with B L is called a P-subset of L Nondeterministic function classes A nondeterministic polynomial-time Turing machine (NPTM, for short) is a Turing machine N such that for some polynomial p, every accepting path of N on any input of length n is at most of length p(n). A nondeterministic transducer is a nondeterministic Turing machine T with a write-only output tape. On input x, T outputs y Σ (in symbols: T(x) y) if there is an accepting path on input x along which y is written on the output tape. Hence, the function f computed by T on Σ could be multi-valued and partial. Using the notation of [10,53] we denote the set {y f (x) y} of all output values of T on input x by set-f (x). The class of all multi-valued, partial functions computable by some nondeterministic polynomial-time transducer T is denoted by NPMV. But also various subclasses of NPMV are of interest. NPSV is the class of functions f in NPMV that are single-valued, i.e., set-f (x) 1. Thus, the functions from NPSV are functions in the usual sense, and we use f (x) to denote the unique string in set-f (x). Relaxing the condition set-f (x) 1 by allowing set-f (x) k for some fixed number k 1 leads to the classes NPkV, defined in [38,15]. Even more generally, Fenner, Fortnow, Naik, and Rogers [15] considered functions f where the cardinality of set-f (x) is bounded by a function g(x) rather than a constant. For a function g, this function class is denoted by NPgV. The domain of a multi-valued function is the set of those inputs x where set-f (x). A function is called total if its domain is Σ. For a function class F we denote by F t the class of total functions in F. We use F t c FP to indicate that for any g F t there is a total function f FP that is a refinement of g, i.e., f (x) set-g(x) for all x Σ. Occasionally it is useful to explicitly indicate the range of a multi-valued function in the notation. To do this we collect in the class F A all functions from F which range over subsets of A Σ,i.e., set-f (x) A for all x Σ. Reductions for nondeterministic functions can be considered from a whole spectrum of reductions, ranging from manyone to Turing reductions. We start with a rather strong notion of many-one reducibility: Definition 1. A multi-valued function h many-one reduces to a multi-valued function g (denoted by h p m g), if there is a function f FP such that for every x Σ set-g(f (x)) = set-h(x). On the other side of the spectrum we use Turing reductions of which different versions are considered in the literature (cf. [16,50,53]). An oracle Turing transducer M may access a single-valued function oracle g by repeatedly querying function values. On such a query x, the oracle returns the unique value from set-g(x) if x is in the domain of g, otherwise M stops without any output. Using this machine model, we define Turing reductions: Definition 2. A multi-valued function h Turing reduces to a multi-valued function g, if there is a deterministic oracle transducer M such that for each single-valued refinement g of g, M g computes a single-valued refinement of h. In between these two kinds of reducibilities, it is natural to consider other variants of many-one reductions, for example, by allowing post-computations (as considered by Krentel [34] and Zankó [56] for P). As we will formulate most of our results in the strongest possible way (by using Turing reductions in hypotheses and many-one reductions in conclusions), they also apply to intermediate reducibilities.

4 3842 O. Beyersdorff et al. / Theoretical Computer Science 410 (2009) Proof systems Cook and Reckhow [12] defined the notion of an abstract proof system for a set L Σ as a (possibly partial) polynomialtime computable function h : Σ Σ with range L. In this setting, an h-proof for the membership of ϕ to L is given by a string w with h(w) = ϕ. We use the notation h m ϕ to indicate that there exists an h-proof of ϕ of size m. Proof systems for the set of all tautologies TAUT are called propositional proof systems. To compare the relative strength of different proof systems, Cook and Reckhow [12] introduced the notion of p- simulation. A proof system h p-simulates a proof system g if g-proofs can be translated into h-proofs in polynomial time, i.e., there is a polynomial-time computable function f such that for each v in the domain of g, h(f (v)) = g(v). Similarly, h is said to simulate g if for each g-proof v there is an h-proof w of length polynomial in the length of v with h(w) = g(v). A proof system for a set L is called (p-)optimal if it (p-)simulates every proof system for L (cf. [32]). It is a natural question to ask whether a set L has a p-optimal (or at least an optimal) proof system. Note that a p-optimal proof system has the advantage that from any proof in another proof system one can efficiently obtain a proof for the same instance in the p-optimal proof system. Hence, any method that is used to compute proofs in some proof system can be reformulated to yield proofs in the p-optimal proof system with little overhead Disjoint pairs and tuples For a class C of sets we call a tuple (A 1,..., A l ) of sets A 1,..., A l C a disjoint C-tuple if A i A j = for all 1 i < j l. For l = 2 we just say that (A 1, A 2 ) is a disjoint C-pair, or simply a C-pair. For such a disjoint pair (A 1, A 2 ) of languages let us say that (A 1, A 2 ) is D-separable if there is a language S D which separates (A 1, A 2 ), i.e., A 1 S and A 2 S = (cf. [23]). Grollmann and Selman [23] introduced a notion of many-one reducibility between disjoint NP-pairs, a stronger version of which was studied in [28]. In [5] these reductions were generalized to tuples as follows. Let (B 1,..., B l ) and (C 1,..., C l ) be disjoint NP-tuples. The tuple (B 1,..., B l ) many-one reduces to the tuple (C 1,..., C l ) if there is a function f FP such that f (B i ) C i for i = 1,..., l. If, in addition, f also respects the complement of the union B 1 B l, i.e., f (B 1 B l ) C 1 C l, then we call the reduction strong. We denote these reductions by p and s, respectively. We remark that f strongly reduces (B 1,..., B l ) to (C 1,..., C l ) if and only if f is a many-one polynomial-time reduction of B i to C i for each i {1,..., l}. 3. Nondeterministic function classes and tuples of NP-sets There is a direct correspondence between nondeterministic functions and tuples of NP-sets, which we will explore in this section. The simplest case is provided by functions from NPSV t and languages from NP conp. With respect to this relation, Selman [53] and Hemaspaandra et al. [25] have shown that NPSV t = FP NP conp t, from which Fenner et al. [15] concluded that NPSV t FP holds if and only if P = NP conp. We complete the picture by showing that this correspondence also extends to the question of the existence of complete problems. Proposition 3. The following conditions are equivalent: (1) NP conp has a many-one complete set. (2) NPSV t has a many-one complete function. (3) NPSV t has a Turing complete function. Proof. For the implication 1 2, assume that C is many-one complete for NP conp. Hence, NPSV t = FP NP conp t = FP C t. But FP C t has a many-one complete function for any C, and therefore also NPSV t has a many-one complete function. The implication 2 3 is immediate. For 3 1, let us assume that h is a Turing complete function for NPSV t. Since NP conp = P NPSV t it follows that NP conp = P h, and P h has a many-one complete set for any function h. Now let us consider the function class NPSV. In the same way as NPSV t corresponds to the language class NP conp, the function class NPSV corresponds to the class of all disjoint NP-pairs. In fact, if we denote the class of all 0,1-valued functions in NPSV by NPSV {0,1}, then any function h NPSV can be identified with the disjoint NP-pair (D 0, D 1 ) where D b = {x Σ h(x) b}. Generalizing this observation, for some finite set A = {a 1,..., a l } Σ containing l 2 elements, the class NPSV A of all functions in NPSV taking only values in A corresponds to the class of all disjoint l-tuples of NP-sets, studied in [5]. If f is a function from NPSV A, then we can define a disjoint l-tuple of NP-sets D f = (D f 1,..., Df l ) by Df i = {x Σ f (x) a i }. Conversely, a disjoint l-tuple of NP-sets (D 1,..., D l ) defines a nondeterministic function as follows. Let M i be nondeterministic polynomial-time machines that decide the sets D i, respectively. The machine M(x) first nondeterministically chooses an index i {1,..., l} and outputs the value a i if the machine M i (x) accepts. Thus M computes a function f from the class NPSV A such that D f = (D 1,..., D l ). This correspondence between functions from NPSV A and disjoint tuples of NP-sets also extends to the respective simulations, namely:

5 O. Beyersdorff et al. / Theoretical Computer Science 410 (2009) Proposition 4. Let A be a finite subset of Σ, and let f and g be functions from NPSV A. Then f p m g if and only if D f s D g. Thus, for example, the class of disjoint NP-pairs has a strongly many-one complete pair if and only if NPSV {0,1} has a many-one complete function. As shown in the next theorem, this is even equivalent to the assumption that NPSV has a many-one complete function. In addition, the theorem gives alternative and easier proofs for some results from [5] on disjoint NP-tuples. Theorem 5. The following statements are equivalent. (1) NPSV has a many-one complete function. (2) For all polynomial-time decidable sets A Σ, the class NPSV A has a many-one complete function. (3) For some set A Σ with at least two elements, the class NPSV A has a many-one complete function. (4) For all numbers l 2 there exist s -complete disjoint l-tuples of NP-sets. (5) For some number l 2 there exist s -complete disjoint l-tuples of NP-sets. (6) There is a s -complete disjoint NP-pair. Moreover, by replacing many-one reducibility by Turing reducibility in items 1 to 3, we obtain three more statements which are also equivalent to the six items in the above list. Proof. To obtain the above equivalences we will verify the following implications: , of which the implications are trivial, and 2 4 as well as 5 3 are clear by the preceding discussion on the reformulation of functions from NPSV as tuples of disjoint NP-sets. It therefore remains to prove the implications 1 2 and 3 1. For the first of these implications let g be a function many-one complete for NPSV and let A Σ be decidable in polynomial time. We fix some element a 0 A and define the function σ as { y y A σ (y) = otherwise. a 0 As A is decidable in polynomial time, the function σ is in FP. Then g (x) = σ (g(x)) is a function in NPSV A. Observe that for a function h NPSV A any many-one reduction from h to g also reduces h to g. Thus g is many-one complete for NPSV A. To prove that item 3 implies item 1, we show that NPSV can be characterized as FP NPSV A, where the value M f (x) computed by the deterministic oracle transducer M on input x is only defined if all oracle queries belong to the domain of the functional oracle f. We first show that FP NPSV A NPSV. Clearly, any function in FP NPSV A is single-valued. Also a computation of M f on input x where f NPSV A can be simulated by a nondeterministic transducer N that simulates M, and for each query z guesses an accepting path of the nondeterministic transducer that computes f and answers with f (x). This guarantees that M f (x) = N(x) if all oracle queries of M f on input x are in the domain of f. If not, then by definition, M f (x) is undefined, and also set-n(x) =, i.e., N(x) is undefined. This shows FP NPSV A NPSV. To see that every function f NPSV is in FP NPSV A, we fix two distinct elements a 0 and a 1 in A and define the following function g NPSV A : a j if z = 1 i, x and the ith bit of f (x) is j, g(z) = a 0 if z = 0 l, x and f (x) < l, a 1 if z = 0 l, x and f (x) = l. Notice that z is in the domain of g, if z = 1 i, x with some x in the domain of f and 1 i f (x), or if z = 0 l, x with some x in the domain of f and l f (x). Now an oracle transducer M g computes f as follows. On input x M g first determines the length l of f (x) by querying 0 l, x for l = 0, 1,... until g(0 l, x ) = a 1 (if x is not in the domain of f, then the first query leads to a reject of M g, otherwise all the strings queried are in the domain of g). If l = 0, then M g outputs λ, otherwise the output of M g is the bit string y 1 y l, where y i = 1 if and only if g(1 i, x ) = a 1. Therefore M g computes the function f. Now the assumption that there is a complete function g for NPSV A implies NPSV = FP NPSV A = FP g, hence also NPSV has a complete function. The additional claims in the theorem about Turing reductions follow directly from the above proof of 3 1. Namely, assuming the existence of a Turing complete function for NPSV A, the equality FP NPSV A = NPSV yields the existence of manyone complete functions for NPSV. Additionally, we can get results on tuples obeying less restrictive disjointness conditions. Namely, we call a collection of sets {D i } i I k-disjoint if i J D i = for all J I such that J > k. For k = 1 this is just the usual pairwise disjointness condition, but for increasing k this leads to successively weaker notions. Reductions are easily generalized to this context, i.e., f strongly reduces (C 1,..., C l ) to (D 1,..., D l ) if f is a many-one polynomial-time reduction from the components C i to D i for i = 1,..., l. Similarly as above, there is a direct correspondence between k-disjoint l-tuples of NP-sets and functions from NPkV A, where NPkV A denotes all functions from NPMV with set-f (x) k and set-f (x) A for all x Σ. Then we have: Proposition 6. For all numbers l > k 1, there exist s -complete k-disjoint l-tuples of NP-sets if and only if NPkV A has manyone complete functions for all subsets A Σ of size A = l.

6 3844 O. Beyersdorff et al. / Theoretical Computer Science 410 (2009) Similarly as in [5], we can show that the question of the existence of complete k-disjoint tuples does not depend on the number of components of the tuple, i.e., for all numbers l, l > k 1, complete k-disjoint l-tuples exist if and only if complete k-disjoint l -tuples exist. Instead of considering functions from NPkV A, it is probably more natural to investigate the function class NPkV, that contains all functions from NPMV such that set-f (x) k for all x Σ (cf. [15,54]). Naik, Rogers, Royer, and Selman [38] showed that with respect to refinements the classes NPkV, k 1, form a strict hierarchy (called the output-multiplicity hierarchy), unless the polynomial hierarchy collapses to its second level. Functions from NPkV correspond to k-disjoint tuples of NP-sets where the number of components is not restricted. Analogously to the implication 1 2 in Theorem 5 we can show the following proposition. Proposition 7. If NPkV contains many-one complete functions, then NPkV A contains many-one complete functions for all polynomial-time decidable sets A Σ. Fenner, Fortnow, Naik, and Rogers [15] investigated the problem whether total functions in NPkV possess refinements in FP. In particular, they proved that the answer to this question is independent of k, i.e., if NPkV t c FP for some k 2, then NPkV t c FP holds for all k 2. Here we are interested in the question, whether these function classes contain complete sets. Concerning this problem we can prove: Theorem 8. (1) If TAUT has an optimal proof system, then for all k, NPkV has a many-one complete function. (2) Let g(x) be a polynomial-time computable function such that for all x Σ we have g(x) p( x ) for some polynomial p. Then the existence of optimal proof systems for TAUT implies the existence of many-one complete functions for NPgV. Proof. The proof follows the general method developed in [28], that amounts to bound the complexity of the promise predicates for NPkV and NPgV. In particular, we have to show that these promise predicates are definable in conp. For this let N be an NP transducer. Then the promise that N(x) outputs at most k different values can be defined by the formula (( ) k+1 y 1... y k+1 y i set-f (x) ) y i = y j, (1) i=1 1 i<j k+1 k+1 where f is the NPMV function computed by N. As the premise i=1 y i set-f (x) defines an NP-predicate, the whole formula (1) is a condition in conp. By choosing suitable polynomial-size nondeterministic circuits for N, we can translate the formula (1) to a sequence of polynomial-size propositional formulas θ k,n n ( p, q, r), which contain propositional variables p = p 1,..., p n for the input x, variables q for y 1,..., y k+1, as well as auxiliary variables r for the gates of the circuits for N. From the construction of θ k,n n it is clear, that the function f computed by N is indeed a function from NPkV if and only if (θ k,n n ) n 0 is a sequence of propositional tautologies. As for each NP transducer N the sequence θ k,n n can be constructed in polynomial time, we can easily define a proof system h N which admits polynomial-size proofs of the sequence θ k,n n. By assumption there exists an optimal proof system h. As h simulates all proof systems h N, we have polynomial-size h-proofs of θ k,n n for all NP transducers computing a function from NPkV. We now claim that the following NP transducer N k computes a function f k that is complete for NPkV: N k takes inputs of the form x, N, 0 m. From this input, N k first computes the formula θ k,n x. Then N k guesses an h-proof π of size m and verifies whether h(π) = θ k,n x. If this is not the case, then N k stops without producing any output. Otherwise, N k simulates N(x) for at most m steps and gives the corresponding output. Clearly, the function f k computed by N k belongs to NPkV. To verify the completeness of f k, let N be an NP transducer computing a function f NPkV and let p be a polynomial bounding the running time of N as well as the size of h-proofs for θ k,n k,n p( x + θ n. Then f many-one reduces to f k via the mapping x x, N, 0 n ). For item 2 let g FP such that for all x Σ we have g(x) p( x ) for some polynomial p. Similarly as above, we define for each function f NPgV the promise of f (x) with respect to NPgV by (( g(x)+1 y 1... y g(x)+1 i=1 y i set-f (x) ) 1 i<j g(x)+1 y i = y j ). (2) By the conditions on g, the propositional translations of (2) have polynomial size in the length of x. A complete function for NPgV is then obtained analogously as in the proof of item 1. Note that if g(x) is a function with super-polynomial increase in x, then it is not clear whether the formulas (2) can be described by propositional formulas of size polynomial in x, and therefore the above proof method fails for such functions g. We also leave open, whether the reverse implications of items 1 and 2 are valid. As a more general program, it seems interesting to determine the relationship between the assumptions of the existence of complete functions in NPkV and NPgV for different numbers k and functions g. We conclude this section by observing that the class of disjoint conp-pairs corresponds to the class NPbV t of all 0,1- valued functions in NPMV t, studied in [15]. With a disjoint conp-pair (A 0, A 1 ) we associate the function h NPbV t defined by set-h(x) = {b x / A b }).

7 O. Beyersdorff et al. / Theoretical Computer Science 410 (2009) Again, it is interesting to see what happens if we extend the range from {0, 1} in NPbV t to arbitrary sets A Σ. If A = {a 1,..., a k } contains exactly k elements, then a function g from NPMV t,a corresponds to a tuple (A 1,..., A k ) of conpsets with A i = {x a i / set-g(x)}. As every x can be contained in at most k 1 sets from A 1,..., A k, the tuple (A 1,..., A k ) is (k 1)-disjoint (but not necessarily pairwise disjoint). Given this correspondence between conp-tuples and functions from NPMV t, we obtain the following result. Theorem 9. (1) If NPMV t has many-one complete functions, then there exist strongly many-one complete disjoint conp-pairs. (2) More generally, if NPMV t has many-one complete functions, then there exist s -complete (k 1)-disjoint k-tuples of conpsets for all k 2. Proof. It suffices to prove the second item. Using a similar argument as for the implication 1 2 in Theorem 5, we can show that the existence of complete functions for NPMV t implies that for every k 2 there exist complete functions in NPMV t,a for each A Σ containing exactly k elements. By the above correspondence between functions from NPMV t,a and (k 1)-disjoint k-tuples of conp-sets, we obtain the asserted complete k-tuple. We leave open whether the reverse implications also hold. 4. Collapse of NPSV and effective interpolation In this section we investigate the question whether functions from NPSV admit total extensions in FP or FP/poly. We show that this question can be characterized by interpolation properties, which in turn are intimately connected with disjoint NPpairs associated with propositional proof systems. We will start by reviewing different notions of interpolation along with their connections to disjoint NP-pairs. Due to Craig s interpolation theorem for propositional logic, for any tautology ϕ ψ there is a formula θ that uses only common variables of ϕ and ψ such that ϕ θ and θ ψ are tautologies [13]. A circuit C that computes the same function as θ is called an interpolant of ϕ ψ. Lower bounds for the size of interpolants were first considered by Mundici [37], who proved that the existence of polynomial-size interpolants for all tautologies ϕ ψ implies NP conp P/poly. As the existence of polynomial-size interpolants for all tautological implications seems to be a rather strong assumption, Krajíček [31] suggested to measure the size of an interpolant not merely in terms of the size of the implication ϕ ψ, but in terms of the size of the shortest proof of this implication in some fixed proof system. This leads to the following definition: Definition 10 (Krajíček, Pudlák [33]). A proof system h for TAUT admits effective interpolation if there is a polynomial p such that for any h-proof w of a formula h(w) = ϕ ψ, the formula h(w) has an interpolant of size at most p( w ). Effective interpolation is sometimes considered in an efficient version such that it is possible to generate an interpolating circuit from an h-proof of a formula ϕ ψ in polynomial time. In [42] this property is called feasible interpolation. Feasible interpolation has been shown for resolution [31], the cutting planes system [8,31,40], and some algebraic proof systems [43]. Combined with lower bounds for the separation of the clique colouring pair by monotone Boolean circuits [44,1], these results yield lower bounds for the proof lengths in the above proof systems. We refer to the survey [41] for a detailed presentation of this approach. To capture the feasible interpolation property, Pudlák [42] defines an interpolation pair (I 0, h I1 h ) for a propositional proof system h with the components I i h = { ϕ 0, ϕ 1, π ϕ 0 and ϕ 1 do not share variables, ϕ i is satisfiable, and h(π) = ϕ 0 ϕ 1 } for i = 0, 1. Let us briefly argue for the disjointness of the pair: The proof π ensures that ϕ 0 ϕ 1 is tautological and since ϕ 0 and ϕ 1 do not share variables, one of the formulas ϕ 0 or ϕ 1 must itself be a tautology. Therefore, ϕ 0 and ϕ 1 cannot be both satisfiable and hence I 0 h I1 = h. Pudlák [42] shows that feasible interpolation for a propositional proof system h is modeled by the pair (I 0, h I1 h ) (cf. the remark after Theorem 12 below). The pair is, however, not suitable for the notion of effective interpolation, for which reason we will now define a nonuniform version of it. To characterize the notion of effective interpolation for a propositional proof system h by a disjoint NP-pair, we define the following interpolation pair Int(h) with the components Int 1 (h) = { ϕ( x, ȳ), ψ( x, z), ā, 0 m x are the common variables of ϕ and ψ, ϕ(ā, ȳ) is satisfiable, and h m ϕ( x, ȳ) ψ( x, z)} Int 2 (h) = { ϕ( x, ȳ), ψ( x, z), ā, 0 m x are the common variables of ϕ and ψ, ψ(ā, z) is satisfiable, and h m ϕ( x, ȳ) ψ( x, z)}.

8 3846 O. Beyersdorff et al. / Theoretical Computer Science 410 (2009) Let us first argue that Int(h) is indeed a disjoint NP-pair. Clearly, both components are in NP. To verify the disjointness, assume that ϕ( x, ȳ), ψ( x, z), ā, 0 m is contained in Int 1 (h). Since we have an h-proof, the formula ϕ( x, ȳ) ψ( x, z) is a tautology. By assumption, ϕ(ā, ȳ) is satisfiable and hence ψ(ā, z) must be a tautology. Therefore, ψ(ā, z) is unsatisfiable which implies ϕ( x, ȳ), ψ( x, z), ā, 0 m Int 2 (h). Before we start to explain the link of the interpolation pair to different notions of interpolation, let us mention a general connection between propositional proof systems and disjoint NP-pairs. For this connection, disjoint NP-pairs are represented by sequences of propositional formulas (cf. [4]). The formal definition is as follows: A propositional representation for an NP-set A is a sequence of propositional formulas ϕ n ( x, ȳ) with the following properties: (1) ϕ n ( x, ȳ) has propositional variables x and ȳ such that x is a vector of n propositional variables. (2) There exists a polynomial-time algorithm that on input 1 n outputs ϕ n ( x, ȳ). (3) Let ā {0, 1} n. Then ā A if and only if ϕ n (ā, ȳ) is satisfiable (where we have substituted the propositional variables x by the bits ā). With these propositional descriptions of NP-sets we can represent disjoint NP-pairs in propositional proof systems. We say that a disjoint NP-pair (A, B) is representable in a propositional proof system h if there are propositional representations ϕ n ( x, ȳ) of A and ψ n ( x, z) of B such that x are the common variables of ϕ n ( x, ȳ) and ψ n ( x, z) and h p(n) ϕ n ( x, ȳ) ψ n ( x, z) for some polynomial p. Let us remark, at this point, that every disjoint NP-pair (A, B) is representable in some propositional proof system by simply coding a representation of (A, B) into a given base system. As a concrete example, let us explain how this works for the extended Frege proof system EF (cf. [12]). If ϕ n ( x, ȳ) and ψ n ( x, z) are propositional representations for the NP-sets A and B, respectively, then the pair (A, B) is representable in the system EF + {ϕ n ( x, ȳ) ψ n ( x, z) n 0} which augments EF by additional axioms for the disjointness of the pair (A, B). Such extensions EF + Φ by polynomial-time decidable sets Φ of tautologies are of particular interest, as every propositional proof system is simulated by such a system EF + Φ for suitable axioms Φ (cf. [30]). Before we explain how the interpolation pair Int(h) captures effective interpolation for h, we will show that Int(h) serves as a hard pair for the class of all pairs representable in the system h (this class was investigated in detail in [4] under the name DNPP(h)). We formulate this observation in the next proposition. Proposition 11. For every proof system h the interpolation pair Int(h) is s -hard for the class of all disjoint NP-pairs that are representable in h. Proof. Let h be a proof system and let (A, B) be a disjoint NP-pair such that ϕ n ( x, ȳ) and ψ n ( x, z) represent A and B, respectively, and h p(n) ϕ n ( x, ȳ) ψ n ( x, z) for some polynomial p. It is then straightforward to verify that a ϕ a ( x, ȳ), ψ a ( x, z), a, 0 p( a ) realizes the reduction (A, B) s Int(h). Now we want to argue that Int(h) indeed justifies its qualification as a pair that describes the effective interpolation property. To this end, we consider, for a given propositional proof system h, the following three assertions: A 1 (h): A 2 (h): A 3 (h): The interpolation pair Int(h) is P/poly-separable. h has effective interpolation. All disjoint NP-pairs that are representable in h are P/poly-separable. Then the following implications between these assertions hold. Theorem 12. (1) For all propositional proof systems h the implications A 1 (h) A 2 (h) A 3 (h) hold. (2) Let h be a proof system of the form EF + Φ with a polynomial-time decidable set of tautologies Φ. Then the equivalences A 1 (h) A 2 (h) A 3 (h) hold. Proof. To prove the implication A 1 (h) A 2 (h) for arbitrary proof systems h, assume that Int(h) is separated by the polynomial-size circuit family C n, i.e., for inputs ϕ( x, ȳ), ψ( x, z), ā, 0 m of length n from Int 1 (h) the circuit C n outputs 1, and C n outputs 0 for inputs from Int 2 (h). Let ϕ( x, ȳ) ψ( x, z) be an implication that has an h-proof of length m. By substituting ϕ, ψ, and 0 m for the respective input gates of the appropriate circuit C n, we obtain a circuit with inputs x that interpolates ϕ and ψ. For the implication A 2 (h) A 3 (h) let (A, B) be a disjoint NP-pair that is representable in h with respect to the representations ϕ n ( x, ȳ) and ψ n ( x, z), i.e., we have h-proofs of length p(n) for the sequence of formulas ϕ n ( x, ȳ) ψ n ( x, z) with some polynomial p. As h has effective interpolation by A 2 (h), there exist interpolating circuits C n ( x) for ϕ n ( x, ȳ) ψ n ( x, z). Hence the circuit family C n provides a separator for (A, B). For item 2 it remains to show the implication A 3 (h) A 1 (h) for proof systems h of the form EF + Φ with a polynomialtime decidable set Φ TAUT. For this it suffices to prove the representability of Int(h) in the system h, i.e., we have to construct representations of Int(h) such that h admits short proofs for the disjointness of Int 1 (h) and Int 2 (h) with respect

9 O. Beyersdorff et al. / Theoretical Computer Science 410 (2009) to these representations. A direct construction of such h-proofs would be quite tedious, but we can use the correspondence of extensions of EF to first-order arithmetic theories (cf. [30,6] for background information). In this framework, the argument proceeds as follows: first we choose natural arithmetic formulas defining the components of Int(h). We now argue in the arithmetic theory S 1 2 augmented by the reflection principle of h (reflection is a strong way to state the correctness of the proof system h). Using the reflection principle it is then straightforward to verify the disjointness of Int(h) with respect to the chosen arithmetic representations by a first-order proof. This proof can be translated into a sequence of polynomial-size propositional proofs in the system h, yielding representability of Int(h) in h. For a more detailed description of this procedure we refer to [4,5]. Under reasonable assumptions on the proof system h, we can show a similar result as in Theorem 12 for (I 0, h I1 h ) and the efficient analogues of A 1 (h) to A 3 (h). In particular, h has feasible interpolation if and only if (I 0, h I1 h ) is P-separable (assuming some simple closure properties of h such as closure under substitution by constants, cf. [42]). As mentioned above, weak systems, like resolution or cutting planes, are known to possess effective interpolation [8,31,40]. In contrast, there is evidence that strong propositional proof systems like Frege systems and their extensions do not admit effective interpolation [33,9,7]. In particular, it is observed in [33] that extended Frege proof systems do not admit effective interpolation if the RSA cryptosystem is secure. Partly generalizing this observation, one can state that the existence of an honest injective function in FP that is not FP/poly-invertible (i.e., a one-way function that is secure against FP/poly) implies the existence of a proof system for TAUT that does not admit effective interpolation. Notice that each injective function in FP is invertible by an NPSV-function. Thus the assumption that each NPSV-function has a total extension in FP/poly implies that every injective function is FP/polyinvertible. As the former assumption implies NP conp P/poly and the latter is equivalent to UP P/poly (cf. [27,23]), the former assumption is presumably stronger. We now show that every function in NPSV has a total extension in FP/poly if and only if every proof system for TAUT admits effective interpolation. Theorem 13. The following statements are equivalent. (1) Every propositional proof system admits effective interpolation. (2) Every disjoint NP-pair is P/poly-separable. (3) Every function in NPSV has a total extension in FP/poly. (4) For every set S TAUT, S NP, there is a polynomial p, such that any formula ϕ ψ S has an interpolant of size at most p( ϕ ψ ). (5) For every printable set S TAUT, there is a polynomial p, such that any formula ϕ ψ S has an interpolant of size at most p( ϕ ψ ). Proof. For the proof we will show the implications as well as 4 1 and 5 2. The implication 4 5 is immediate, as item 5 is a weakening of item 4. Items 1 and 2 are the universally quantified versions of the assertions A 2 (h) and A 3 (h), respectively, i.e., item 1 expresses that A 2 (h) holds for all propositional proof systems h. Similarly, this holds for item 2 and assertion A 3 (h), as every disjoint NP-pair (A, B) is representable in a proof system EF + {ϕ n ψ n } with arbitrary representations ϕ n and ψ n for A and B, respectively. Therefore the implication 1 2 is a direct consequence of Theorem 12. The implication 2 3 was shown in [52], but for the sake of completeness we include a proof. Assume that all disjoint NP-pairs are P/poly-separable, and let f be a function in NPSV. With f we associate a pair (A f, 0 Af 1 ) with the components A f i = { x, j ( y)y set-f (x), 1 j y, and the j-th bit of y is i}. This disjoint NP-pair describes all bits of the values of f. To determine the length of f -values we define a second NP-pair (B f, 0 Bf 1 ) with the components B f 0 B f 1 = { x, j ( y)y set-f (x) and j y } = { x, j ( y)y set-f (x) and j > y }. By assumption the pairs (A f, 0 Af ) 1 and (Bf, 0 Bf ) 1 can be separated by polynomial-size circuit families C n and D n, respectively. Using these circuits we devise a function g FP/poly that refines f as follows. Let p be a polynomial bounding the running time of f. At input x, the function g evaluates all respective circuits from D n on inputs x, 1,..., x, p( x ) + 1 to determine the length l of the possible output value of f (x). After l is computed, g evaluates the circuits C n on inputs x, 1,..., x, l. The output of g is then just the bitwise concatenation of these values. From the construction it is clear that g FP/poly refines the function f. The proof of the implication 3 4 is obtained by extending an idea from [52]. Let S TAUT, S NP. Let f be a function such that for any formula ϕ S, ϕ = ϕ 0 ( x, ȳ) ϕ 1 ( x, z), it holds { 1 if for some β, ϕ0 (α, β) holds f ( α, ϕ ) = 0 if for some γ, ϕ 1 (α, γ ) holds.

10 3848 O. Beyersdorff et al. / Theoretical Computer Science 410 (2009) Otherwise, and for any other input let f be undefined. First observe that f is well defined, i.e., that f is single valued. This is due to the fact that ϕ = ϕ 0 ( x, ȳ) ϕ 1 ( x, z) TAUT. Further, f can be computed by a nondeterministic machine N that first (in deterministic polynomial time) validates that the input is of the appropriate form α, ϕ, ϕ = ϕ 0 ( x, ȳ) ϕ 1 ( x, z). Then N guesses a certificate for ϕ S and, if successful, guesses some string w. Now if w is of an appropriate length and if ϕ 0 (α, w) holds, then N outputs 1, if ϕ 1 (α, w) holds, N outputs 0. Hence f NPSV. Assuming 3, f has a total extension in FP/poly. Thus there is a polynomial p and for any n 0 a circuit C n of size at most p(n) such that for any tuple v = α, ϕ of length n in the domain of f, C n (v) = f (v). Fixing the input bits of C n that belong to the formula ϕ, we obtain a circuit C ϕ with C ϕ (α) = C n ( α, ϕ ) = f ( α, ϕ ), and thus C ϕ is of size polynomial in ϕ. Now observe that C ϕ is an interpolant for the formulas ϕ 0 ( x, ȳ) and ϕ 1 ( x, z). If ϕ 0 (α, ȳ) SAT, then C ϕ (α) = 1, and if C ϕ (α) = 1, then for no γ it holds ϕ 1 (α, γ ) and therefore ϕ 1 (α, z) TAUT. To prove the implication 4 1, let pad: Σ {0} Σ be a function in FP with the following properties: (1) pad(χ, 0 n ) TAUT if and only if χ TAUT. (2) given an implication ϕ ψ TAUT as an input, the output pad(ϕ ψ, 0 n ) is also an implication ϕ ψ that has the same interpolants as ϕ ψ. (3) pad(χ, 0 n ) χ + n. Notice that there is such a padding function. Now let h be a proof system for TAUT, and let S = {χ n χ w, w n, pad(h(w), 0 n ) = χ}. Clearly S NP, as pad and h are functions in FP. Because h is a proof system for TAUT and due to property 1 of pad, S TAUT. Thus by assumption 4 there is a monotone polynomial p, such that any formula ϕ ψ S has an interpolant of size at most p( ϕ ψ ). As pad, h FP there are monotone polynomials q, r such that h(w) q( w ) and pad(χ, 0 n ) r( χ + n) for any w, χ Σ, n 0. Let ϕ ψ TAUT and let w be an h-proof for ϕ ψ. Now by property 3 of pad ϕ ψ = pad(ϕ ψ, 0 w ) S, therefore by the property 2 of pad, ϕ ψ has an interpolant of size at most p( ϕ ψ ) p(r(q( w ) + w )). To finish the proof let us show that the implication 5 2 holds. Let (A, B) be a disjoint NP-pair. We choose arbitrary representations ϕ n ( x, ȳ) for A and ψ n ( x, z) for B. By the disjointness of A and B, ϕ n ( x, ȳ) ψ n ( x, z) is a printable sequence of tautologies. Assuming 5 we get polynomial-size interpolating circuits for these formulas. These circuits separate the pair (A, B). Part of the equivalences of the last theorem were already shown by Schöning and Torán [52]. There they proved that items 2, 3, and 5 are equivalent, and that these hypotheses imply NP conp P/poly and UP P/poly. Let us note that Theorem 13 also holds in an efficient version, where FP/poly is replaced by FP, and effective interpolation is strengthened to feasible interpolation. It is readily checked that the proof of Theorem 13 is easily modified to this efficient context. Hence Theorem 13 along with its proof yield the following corollary: Corollary 14. The following statements are equivalent. (1) Every propositional proof system admits feasible interpolation. (2) Every disjoint NP-pair is P-separable. (3) Every function in NPSV has a total extension in FP. Let us mention that the above list of equivalences also relates to the important concept of automatizability, as recently noted by Sadowski [49]. In [9] a proof system h is called automatizable if there exists a deterministic procedure that takes as input a formula ϕ and outputs an h-proof of ϕ in time polynomial in the length of the shortest h-proof of ϕ. A proof system g is called weakly automatizable if there exists an automatizable system h that simulates g (cf. [42]). In [49] Sadowski proves that items 2 and 3 from Corollary 14 are equivalent to the statement that every propositional proof system is weakly automatizable. This leads us to the following corollary: Corollary 15. The following statements are equivalent. (1) Every propositional proof system admits feasible interpolation. (2) Every propositional proof system is weakly automatizable. It is easy to see that a proof system g admits effective interpolation if g is simulated by a proof system h that admits effective interpolation. As a corollary from Theorem 13 we obtain: Corollary 16. If there is an optimal proof system for TAUT that admits effective interpolation, then items 1 to 5 from Theorem 13 hold.